19 ms·
Fixing a bug in Google Chrome as a first-time contributor
- KolmogorovComp 2y ago> Although the worklet was running on a worker thread, it didn't have a WorkerGlobalScope - it had a WorkletGlobalScope. It took me a while to see these were different, I thought it was a wrong copy-paste. Naming things is hard, but this is a bad convention. Always put the changing bits at the beginning preferably, or the end otherwise, but never in the middle, especially when it's subtle in a rather verbose name.
- dangsux 2y ago[dead]
- sd9 2y agoThe changing bit is at the beginning, unless I misunderstand you. Worker and Worklet are primitives, you can't really split them up. You can't have a LetWorkGlobalScope and an ErWorkGlobalScope, so WorkerGlobalScope and WorkletGlobalScope is the best you can do. That said, I usually prefer the changing bit at the end. So something like GlobalScopeForWorker, GlobalScopeForWorklet. But then that's clunky, so we're back at WorkerGlobalScope and WorkletGlobalScope again.
- mrunkel 2y agoI think they mean that the change is at the end of the first word in the Variable. i.e, Worker vs. Worklet instead of Worker vs. TinyWorker? Doesn't make too much sense to me, but I think that's what they are saying.
- sd9 2y agoThat seems reasonable. I understand Worker and Worklet are established concepts in the domain, though, so better to use those names than invent new terminology.
- Neywiny 2y agoI think subconsciously I look to the end to find differences too. So maybe I'd prefer er/let to come last
- macintux 2y agoWhen I joined my current team, I was surprised when I realized all of my co-workers were using the end of strings to verify their identity, when I was looking at the beginning of them. It was confusing: I'd be reading off random characters, and they'd be reading them aloud at the same time, and we'd all be saying different things.
- dylan604 2y agoI've run into this with GUID/UUID strings. Some apps truncate them while appending an ellipses to the end, so that the last bits of characters are not even visible by default. It's a mixed bag to be sure
- physicles 2y agoI feel like if you have to display UUIDs in your app’s UI, you’ve already lost. Copy to clipboard should hopefully be enough.
- dylan604 2y agoIt doesn't matter when/where the IDs are or how they are to be used. Ever been on a call trying to get someone to look at a specific commit? There are plenty of cases where using some sort of ID is necessary. I think you've chosen the very wrong part of the comment to focus on, like the actual point.
- matrss 2y ago> That said, I usually prefer the changing bit at the end. So something like GlobalScopeForWorker, GlobalScopeForWorklet. But then that's clunky, so we're back at WorkerGlobalScope and WorkletGlobalScope again. I wouldn't necessarily call "GlobalScopeForWorker" more clunky than "WorkerGlobalScope", just a bit longer, but also more descriptive. Using the languages namespacing features might also make it more obvious, e.g. "Worker::GlobalScope" and "Worklet::GlobalScope" or the inverted version "GlobalScope::{Worker,Worklet}". Looking at it from a functional programming perspective, I also like approaches of the form "GlobalScopeFor({Worker,Worklet})", i.e. a function returning the respective thing. Naming things is hard, but the possibilities are endless...
- mirekrusin 2y ago„Of” is underused in programming. It’s short, can appear standalone, as prefix, infix and suffix and it’s generic enough that it works in most contexts for types, type functions, functions, constructors, mappings etc.
- n_plus_1_acc 2y agoWhen Java introduced List.of(1, 2, 3), I was sceptical but now I like it
- dotancohen 2y agoIt seems to me that the problem was naming something Worklet when another thing called Worker already exists. I personally strive for unique class names when possible. But that decision was made long before OP started contributing to this project.
- Quothling 2y ago> That said, I usually prefer the changing bit at the end. So something like GlobalScopeForWorker, GlobalScopeForWorklet. But then that's clunky, so we're back at WorkerGlobalScope and WorkletGlobalScope again. I've done this and it's always ended up biting me in the ass when I want to auto-complete and have 9 million "GlobalScope..." to chose from. Which is where "Work..." becomes handy.
- kevindamm 2y agoDepending on your IDE and/or plugin used for autocomplete, you can usually type "worklet" and the symbols containing that substring will still be included in that list, even if it's at the end.
- xboxnolifes 2y agoOn the other hand, it can be nice for other types of autocomplete usage. Say I know I'm looking for a GlobalScope, but I just don't know which one. Type "GlobalScope" and you get a nice list of everything prefixed with it. It's nice for things like Error enums, or similar usages. I know I'm looking for an Error, but I'm not sure of all the ones available to me.
- oefrha 2y agoThis is no name confusion bug, the bug is whoever wrote the code simply didn’t consider enabling the functionality for worklets (maybe worklets weren’t even a thing when that particular piece of code came into existence), and the fix is to change WorkerGlobalScope to WorkerOrWorkletGlobalScope. I don’t write code so that drive-by internet commenters looking at a random snippet always find it unmistakably clear in ten seconds, and I don’t expect anyone else to adhere to that standard.
- bfgeek 2y agoThese names come from the html spec: https://html.spec.whatwg.org/#workerglobalscope https://html.spec.whatwg.org/#workerglobalscope https://html.spec.whatwg.org/#workletglobalscope https://html.spec.whatwg.org/#workletglobalscope Chromium (and most other browser engines) will use the specification names for things like this. E.g. equivalent code in WebKit, and Gecko: https://github.com/WebKit/WebKit/blob/80c1e6d05e4679c08e3a6e16b61ca8059bd39245/Source/WebCore/worklets/WorkletGlobalScope.h#L54 https://github.com/WebKit/WebKit/blob/80c1e6d05e4679c08e3a6e... https://searchfox.org/mozilla-central/source/dom/worklet/WorkletGlobalScope.h#46 https://searchfox.org/mozilla-central/source/dom/worklet/Wor...
- mherrmann 2y agoCongratulations! And thank you for the great write-up. I work with the Chromium code base a lot, and it can indeed be daunting. I use Sublime Text, which treats the code as plain text, apart from syntax highlighting. But it's also possible with at least VS Code to get some more intelligence, such as going to the definition or declaration of a function, etc. People who have now become interested in creating their own Chromium-based browser may want to take a look at my article: https://omaha-consulting.com/how-to-fork-chromium https://omaha-consulting.com/how-to-fork-chromium. It gives a high-level view of what goes into maintaining a Chromium fork.
- Cthulhu_ 2y agoReminds me of my early experience with larger-scale JS development (early single page apps or whatever they're called now); there were no good IDEs yet, no module / require system, no types or whatever. Sublime Text and fast global search were my go-to tools, and it gave me a newfound appreciation of consistent naming schemes and structures. Not so much nowadays though, most of the time I use IDEA with Typescript and the like. And yet, I still feel like I lost something moving away from sublime. I've reinstalled and am trying it again lately.
- frou_dh 2y agoSublime Text has had some IDE-like abilities even before the LSP plugin, because its own filesystem code indexer reuses the syntax-highlighting language grammars to power best-effort goto-definition / goto-references functionality. How well that actually works varies by language.
- KolmogorovComp 2y agoFrom your post > you will (...) want to change the name of your browser [to] "Browser of Bliss" instead of as "Chromium". You will find that this is already hard to do. The browser name is hard-coded in many places in the millions of lines of Chromium source code. (...) Viasat are offering a (...) fork called Rebel that makes this easier I am surprised that kind of change has not been upstreamed, or is Google actively working against forks?
- kenrick95 2y ago> but a clean build still takes something like 45 minutes to finish I had a similar experience when building Firefox from source >.< though I recall I had more trouble when pulling the codes as I was naive and pulled all the history
- nbenitezl 2y agoIn 2013 I also worked as first time contributor on a bug that affected the linux version of Firefox. Firefox took 2 hours to compile in my pentium dual-core Intel laptop, it was in August so warm inside the house, the 2 hours compiling at closer 100% cpu made the laptop halt due to excessive temperature before finishing. I also recall the build failed because of out-of-memory error (ram exhausted) I had 2GB and had to expand to 4 GB or something like that. After overcoming the struggles I was finally happy as the fix was committed.
- mrweasel 2y agoNot that I really see away around it, given the size and feature set of Chrome, but those build requirements are just crazy. It kinda throws the open source and "everyone can contribute" model out the window, if you can't afford a pretty insane workstation then you're going to have a bad time. I doubt that Firefox is better, I seem to remember that building Firefox and the VIA C3 processor years back as around half a day of compiling, but was also an extremely poorly choose CPU for the task.
- creesch 2y ago> It kinda throws the how open source and "everyone can contribute" model out the window, if you can't afford a pretty insane workstation then you're going to have a bad time. That, it also means you are going to spend a lot of time on it before you can even attempt to do anything. Overall, there can be a pretty substantial amount of effort involved before you are even ready to make a PR of any kind. Then it remains to be seen if it is well received by the people who can approve it. You mention Firefox, my dealings with various contributors and people at Mozilla over the years would make me very hesitant to even consider diving into the deep end. To be fair, I have had good interactions with various people as well. But a lot of communication also has been just outright difficult. All of this also throws out the "if you don't like it, you can just fork it" mindset.
- cxr 2y ago"Patches welcome" vs "patches wanted"[1]. 1. <https://www.colbyrussell.com/2013/08/06/patches-wanted.html https://www.colbyrussell.com/2013/08/06/patches-wanted.html>
- Glacia 2y agoOn a similar note, i always wanted to contribute to Firefox, but every time i looked at how to compile it i noped the fuck out of it. It's probably is doable on linux but it's sounds like a nightmare on windows.
- ParetoOptimal 2y agoYou can develop Firefox with Nix. https://github.com/mozilla/nixpkgs-mozilla?tab=readme-ov-file#checking-out-firefox https://github.com/mozilla/nixpkgs-mozilla?tab=readme-ov-fil... Then you can use Nix from windows, but im unsure of performance or friction as I've totally abandoned windows personally. Here are some resources: https://nathan.gs/2023/12/14/nixos-on-windows/ https://nathan.gs/2023/12/14/nixos-on-windows/ https://nixos.wiki/wiki/Nix_Installation_Guide#Windows_Subsystem_for_Linux_.28WSL.29 https://nixos.wiki/wiki/Nix_Installation_Guide#Windows_Subsy...
- coldpie 2y ago> It's probably is doable on linux Yep. The way you do it on Linux is to grab your distro's package build script and use that. It will specify all of the build- and run-time dependencies (which you use your standard package manager to resolve), and contain whatever commands are required to build it. Usually you just install dependencies and run one command, and you've got a package you can install like any other. Here, for example, is the script for Arch Linux's Firefox package: https://gitlab.archlinux.org/archlinux/packaging/packages/firefox/-/blob/main/PKGBUILD https://gitlab.archlinux.org/archlinux/packaging/packages/fi... Just install the dependencies listed there, run "makepkg", and boom, Firefox pops out the other end. If you're doing active development, you can probably figure out a quicker change/build/test loop, but that'll get you started. > but it's sounds like a nightmare on windows. I wouldn't wish the hell of software development on Windows upon my worst enemy :)
- creesch 2y agoInteresting to read all of this. Bugs in more obscure areas being open for years is something I am pretty familiar with, although then on the Firefox side of things. I personally never have been able to muster up the courage or energy to try and dive into the code base there, though. Part of that is simply because such a huge code base is daunting to delve into. But an even bigger stumbling block was always the prospect of having to deal with the entire process of submitting the fix and getting it approved. Certainly with Mozilla the interactions I have had on Bugzilla with various people there as well as in other places simply made me decide to work around the issues. I am honestly surprised how relatively smooth the process seems to have been for the author, dealing with Chromium developers.
- rrr_oh_man 2y ago> Certainly with Mozilla the interactions I have had on Bugzilla with various people there as well as in other places simply made me decide to work around the issues. Can you elaborate on your experience?
- creesch 2y agoSure. I should point out though that I also had many positive individual experiences with people from Mozilla. Interesting conversations and insights in various things. It is just that overall I had a few too many interactions, which would make hesitate trying to invest a lot of time in things like PRs. What it mostly comes down to is that communication several times seemingly seemed a one way street. Where I provided information (often explicitly asked for) only to be effectively ghosted. Not in the sense that I was dealing with busy people where it just took time for them to get back to it again. But really getting no response at all. Often when I then did follow up on it (several months later) I would see the bugzilla ticket change a tag or some other meta attribute but nothing more. To be clear, this isn't even unique to Mozilla/Firefox. I had similar experiences on other open source projects, although it differs really per project. It is more that with something as big as a browser, where setting up the development environment can already take up the better part of a day, it becomes an extra barrier for even trying.
- varispeed 2y agoHave you got paid for this? The reason I am asking is that I see volunteering time for extremely wealthy big corporations as foolish. At very least developers should get together and lobby that if big corporations use open source software, they should be paying royalties to contributors. That said, if you look at volunteering time, it is much better to do it for charities that often struggle getting competent IT people, but of course it is not as glamourous.
- bugtodiffer 2y agosadly bounties only barely work in a security setting and I've never seen it work for other things. Too much noise vs value.
- riiii 2y agoYou're such a good man, you don't need to use such hash language.
- madeofpalk 2y agoThis is fair, and is my general philosophy. But if you're running into the bug first hand and its costing you otherwise, it may be the most pragmatic thing to just fix the bug yourself and contribute it back.
- creesch 2y agoConsider this, the thing they fixed is something they depend on for their daily programming needs relatively often. By fixing it themselves instead of waiting for who knows how long, they are saving a lot of future time and frustration. They don't to work around the issue anymore and can simply focus on what they want. Which is also worth something.
- varispeed 2y agoBut that will make these companies lazy. Chromium is open source, in my opinion, because Google can brag about open source, it has all the right buzzwords. But also gives them free R&D and labour. I think given the size and wealth of Google, this is entirely inappropriate and people shouldn't be contributing to it, because it will only encourage this parasitic and exploitative behaviour.
- pilif 2y agoI'm coming out of reading this a bit dismayed as I really thought that the `if let` (to use the swift conventions) pattern would finally be a good and reliable solution for these silent errors. And at the same time, reading the code in question and putting myself into the position of a person writing the code, I would totally have thought that I'm handling the "is there a global scope" case, totally forgetting that the same check is also checking the "is the global scope a `WorkerGlobalScope`" condition but mixing both checks into a single return value. And here we are with the code happily chugging along and (for all intents and purposes) causing data corruption (by causing network requests to not be logged and not respect policy). And here I was thinking that `if let` is fixing exactly this problem while also providing the best ergonomics. So here we are back to the drawing board, ready for the next pattern which will compromise on ergonomics in some as-yet unknown way in the future.
- kgeist 2y agoChromium's codebase isn't so bad for a first timer. Years ago our product had a bug on Windows where if you paste an image from the clipboard, the image had garbage in it (something to do with alpha channels). I realized Chrome has no such bug so they probably had a workaround. It took me like 30 minutes of lurking around in the codebase for the first time to find their workaround and apply it to our code.
- bgirard 2y ago> Chromium's codebase isn't so bad for a first timer. Agreed > It took me like 30 minutes I can tell you didn't need to build it ;)
- kccqzy 2y agoWhy build it if you are just reading? I find https://source.chromium.org/chromium https://source.chromium.org/chromium wonderful. With things like go-to-definition and find-all-overridden-functions working wonderfully well. I find this to be ideal when working with a large codebase. I don't even need an editor with fancy intelligence features and LSP integration; a bare bones vim or emacs paired with a website with all the intelligence already there.
- bgirard 2y ago> Why build it if you are just reading? Is this a serious question? Assuming it is, to insert printf statement, or attach a debugger and step through the program and take backtraces to supplement or confirm the information you gather from reading the code.
- kccqzy 2y agoYes it's a serious question. And no, "reading" doesn't involve inserting printf statements or taking backtraces. These are different activities. That's called debugging and not reading. The OP's scenario is being curious how Chromium does something: so it suffices to find the relevant snippet and then copy it elsewhere. The Chromium code is assumed to be already working and does not need debugging.
- nunez 2y ago> I'll unashamedly admit that I made liberal use of printf debugging while trying to make my way through these code paths Nothing to be ashamed of, imo; printf debugging works incredibly well!
- SAI_Peregrinus 2y agoYep. Debuggers are more powerful, they can do everything `printf` debugging can do + more, but take more work to set up. For interpreted languages, they often take more work to use than just adding a print statement & rerunning, for compiled languages the reverse is more likely.
- ivanjermakov 2y agoThere are cases where printf helps but debugging doesn't. Multithreaded code is one of such cases.
- SAI_Peregrinus 2y agoConditional breakpoints that run a script and continue can be used equivalently to printf debugging, just set it to print when the selected line is hit. You can do this without restarting the application, even for multithreaded code. Also watchpoints, for the equivalent but at a memory location instead of a code line. Debugger != breakpoints.
- deckar01 2y ago> one thing that I was completely unsure about was how to add tests for this fix. Similar to blaming the file for maintainers, the diff of those commits can direct you to their tests. The full patches that those commits belong to can also be useful for finding undocumented habits that have lead to approval. https://stackoverflow.com/a/30998048 https://stackoverflow.com/a/30998048
- quirino 2y agoThere's this one Chrome (?) bug I've been experiencing for a long time on Linux. Every once in a while, the browser detects I'm typing "±±±±±±+..." and writes that to any selected text input. It stops when I type anything, but sometimes comes back rather quickly. I thought it was a keyboard issue, but it doesn't affect Firefox or other applications, only Chrome based ones like Spotify and VSCode. I've found no other mention of this on the internet and I'd love to to hunt this down and fix it but have no clue where to start. I guess the first step would be to consistently reproduce the bug... If you're interested, I screen recorded it happening once. Mind there's music playing: https://youtu.be/S7OGTULLsqg https://youtu.be/S7OGTULLsqg.
- bkor 2y ago> Every once in a while, the browser detects I'm typing "±±±±±±+..." Interesting bug! Not exactly following on what triggers the bug. Do you have a ± key on your keyboard (some international one)? Or does it occur after e.g. pressing "+", then "-"? Do you use compose keys? Does it do this randomly?
- quirino 2y agoI don't have a ± key. I'm using swaywm which seems to have no compose key set by default, I've tried all the common ones and they don't act as such. I haven't been able to detect any pattern to what triggers this, at all. It is always "±".
- Suppafly 2y agoYou could probably set up some keylogging to see if anything special is happening before it, it'd also let you know for sure if it's a keyboard issue or not.
- cryptonector 2y agoMaybe there's buggy malware involved?
- modeless 2y agoThis is great! You should consider fixing the Chromium bugs you run into! Chrome releases relatively quickly, so in 4-6 weeks you can have a bug fixed forever for all of your users on Chrome. I used to work on Chrome and WebKit and I still have committer status. I've often wondered if there are people out there who would be willing to pay a contributor to get their bug fixed, but don't know who to contact. Feel free to email me :)
- aardshark 2y agoThere is an annoying bug in Chrome DevTools that people who want to impede debugging of their JS files exploit. I think it's probably related to making the regex engine use excess memory and crashing the tab. Anyway, just mentioning it to see if someone here knows if it's a well known and difficult to fix bug, or if it's just a bit obscure to have had any fixes for.
- modeless 2y agoI haven't seen that one. I'd start by searching crbug.com. Then, the first step to a fix is always to find a reproducible example of the bug. In this case that would probably be finding an example in the wild and trying to save it locally in a way that still reproduces the bug. If you can get those files attached to the bug report there's a good chance it can be fixed. When I was fixing Chromium bugs, repro cases were worth their weight in gold.
- xyst 2y agoA fun project would be to implement a cross platform compatible web browser in rust. Chromium just has so much baggage with it on top of years of Google junk.
- esprehn 2y agoThat sounds like Servo? https://servo.org/ https://servo.org/
- deleted 2y ago[deleted]
- sebstefan 2y ago>I started my debugging by finding where the network request for the worklet script was initiated and tracing it down as far as necessary until the request was actually made - or retrieved from the cache. The call tree looked something like this: It completely escapes me how you can find that in such a codebase.
- macqm 2y ago>Because of this huge codebase size, I wasn't able to get VS Code's C++ extension to work very well with the project. Features like go-to definition (which I usually rely on heavily when navigating codebases) and find references didn't work well or at all, and one of my CPU cores would stay stuck at 100% permanently while the project was open. Chromium Code Search [1] tool is very helpful with that and I believe there are some extensions that integrate with it. 1: https://source.chromium.org/chromium/chromium/src https://source.chromium.org/chromium/chromium/src
- henning 2y agoFirst, thank you for sharing this helpful link, but LOL at needing to use a third party server to search plain text data that could fit in RAM (at least on this developer's machine). JavaScript- and JSON-based developer tooling is a terrible idea.
- trustno2 2y agoIt's not searching plaintext though. VSCode itself can deal with big text data being thrown at it, this will be some of the language server stuff
- henning 2y agoI'm glad VSCode handles large text files better for you than it does for me. Editing anything large in VSCode makes it slow to a crawl on my machines.
- trustno2 2y agoInteresting. The only time I had problems was very big JSONs with everything on one line, but prettifying fixed that. (Or was it XML? I forgot. One of those.)
- coldpie 2y agoI'm sure it can do a plaintext search just fine. What the author is talking about is language-aware features like "go to definition". Holding all of a whole web browser's C++ parsing tree in memory is a lot bigger ask than just its plain text.
- evmar 2y agoThis post is really great! My biggest piece of advice to someone attempting to do the same is to browse the code via the online code browser, which has working cross referencing. (The codebase is so large it is not the sort of index you can reliably build locally...) https://cs.chromium.org https://cs.chromium.org is the easy URL to remember ("cs" for "code search")
- thomasfromcdnjs 2y agoThat was a really good read, thank you!
- genewitch 2y agoregarding the comments about the "build time" of firefox/chromium - a couple of weeks ago i installed gentoo 686 on an old netbook, including a DE/WM and firefox. I also told it to completely recompile everything that comes "preinstalled" in the stage3 gzip (that's prior to installing the WM and ff). llvm took forever to compile, and then for some reason i needed to have two versions of llvm - i don't recall why offhand. So i have a devuan VM on my desktop here, i set up a gentoo chroot, updated it and installed distcc, installed distcc on the netbook - just like i've always done in these circumstances. Believe me when i say: it's still like magic, even if "distcc-pump" no longer works. total time to get the netbook to a stable, running as i want it, useful machine - ~1 week. Results? It's actually useable - more usable than it was with windows 7 on it when it was new, and much more usable than whatever ubuntu i had installed on there 7 years ago or whatever. I did, however, make a mistake. I didn't need to use i686 (32 bit) - the atom is a dualcore and on ark it shows that CPU is 64 bit. So i'll probably do all this again (after a reboot onto gentoo boot media and 'dd'ing /dev/sda2 to a network location, just in case). I may even see if it's possible to resurrect pump, because that will speed things up even more. If pump is working, the only thing that sucks about "emerge" on gentoo on a slow machine is waiting for the spinner at the beginning and the "installing <pkg> ..." parts of the flow, due to memory and CPU contstraints. I'm using an SSD in there so at least i got that going.
- ramshanker 2y agoExcellent. One small question If anyone can answer. When an outside contributor is submitting a fix like these, do open source software maintainers ask for test also to be written? Fix itself is worth acceptance. What if contributor don't have any more time/interest beyond submitting the fix.
- OmarShehata 2y agoyes if the standard practice on the codebase is to include tests, the maintainers will ask for tests if the author doesn't want to do it, the PR will likely remain abandoned unless an external contributor comes along to finish it, or a maintainer takes over.
- bfgeek 2y agoIt depends on the project, but most large scale projects require test(s) for the fix, and will block submission unless its provided. These types of projects undergo constant code-change/refactoring/re-architecture etc. If you don't add a test for your specific issue, there is a non-trivial change that it'd be broken again in some future release. Its somewhat worse if an issue gets fixed, and broken again, vs. it being broken the whole time. E.g. with the former users have likely started to rely on the fixed behaviour, then will experience disruption when it breaks again.
- andai 2y agoI noticed in Chrome based browsers that when I copied an image to clipboard, whole UI would freeze. For large images it would become unresponsive for 5-10 seconds. I dug into the source and turns out they PNG encode it, I believe at highest compression. (The comments indicate this is something to do with how old versions of MS WORD handle transparency..?) My "workaround" was to change the compression level to 0. Not ideal but I only needed to change 1 byte in the exe, and I was glad I didn't need to rebuild all of Chrome! Firefox has 0 lag and has the benefit that you can paste directly into file explorer, because they put the original image file into clipboard instead of image data.
- zetafunction 2y agoAs someone who had the misfortune of working on clipboard support in Chrome, I thought "wow, there's no way we do that in places other than Linux". ... turns out we do and I helped review that patch. Doh! For how widely the clipboard is, the actual implementation (both in the OS and in the browser) is surprisingly unloved and unmaintained. FWIW, Chrome intentionally doesn't plumb through the original image bytes. I wasn't around when it was initially implemented, but even for many years afterwards, there were no (Windows) platform conventions for passing around non-bitmap images on the (Windows) clipboard. And another (probably unintentional) benefit was "the encoded image bytes are from an untrustworthy source and could trigger bugs in buggy image decoders", while bitmaps are (relatively) safe in comparison. Of course, this is a rather arbitrary line, because it's easy to get the original image bytes out of the sandboxed renderer, e.g. by dragging out the image or by saving the image. At this point, someone could probably try plumbing through the original bytes or even implementing delayed rendering... but it's quite expensive in terms of time, especially to test all the random things that might break. :(
- pipeline_peak 2y agoI wonder how many more (quantity or quality) commits OP would have to make before getting interviewed as a chrome dev either by Google or another company that uses Chrome heavily like Samsung.
- aronhegedus 2y agoGood write up! Well done!
- f1codz 2y ago> 33 million lines of code in total Is that a fact? That seems insanely large.
- aembleton 2y ago> That seems insanely large. Browsers contain a lot of logic